ci: build release binaries with goreleaser (#55)

* ci: build release binaries with goreleaser

Six targets, matching the cross-compile job: linux, darwin and windows on
amd64 and arm64. CGO_ENABLED=0 costs nothing — go-keyring shells out to
`security` on macOS and talks D-Bus on Linux, neither of which needs cgo.

The tag drives everything: release-please creates it and the release, then
`mode: append` uploads the archives into that release without touching the
notes it wrote.

beep boop

* ci: attest release archives

goreleaser has no attestation of its own — the documented route is
actions/attest after it runs. subject-checksums attests every file listed in
checksums.txt, so all six archives are covered without naming them.

Verify with `gh attestation verify --owner Flagsmith <file>`.

beep boop

* ci: mark beta releases as Latest

GitHub will not let a prerelease be Latest ("Drafts and prereleases cannot be
set as latest"), and the prerelease flag is not separable from the -beta
version: release-please derives it from the version itself. So clear the flag
after publishing instead. The condition takes itself out of service once 2.0.0
ships, since a stable release becomes Latest on its own.

beep boop

* ci: never touch the notes release-please wrote

`mode` governs the release notes, not the artifacts — those upload either way.
append happens to be harmless while the changelog is disabled, since our notes
are empty, but keep-existing says what we mean and stays correct if anyone
enables the changelog later.

beep boop

* fix: stop snapshot builds claiming to be a release

.Tag is the last release tag even under --snapshot, so every snapshot stamped
v1.1.0 and IsRelease then pinned doc URLs to a tag the build has nothing to do
with. Snapshots now stamp the snapshot version, v1.1.0-SNAPSHOT-090323e.

Stamping the literal `dev` would not have worked: resolve() treats dev as
unstamped and replaces it from debug.ReadBuildInfo, which yields a Go
pseudo-version — correct, but it would show up in --version and the User-Agent
as v1.1.1-0.20260730115333-090323eb8be5+dirty.

beep boop

Author: khvn26

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # upload release artifacts
+      id-token: write # attest artifacts
+      attestations: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Attests every file listed in the checksum file.
+      - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        with:
+          subject-checksums: ./dist/checksums.txt
+
+      # During public beta the newest beta is what people
+      # should land on, so clear it.
+      - if: contains(github.ref_name, '-beta')
+        run: gh release edit "$GITHUB_REF_NAME" --prerelease=false --latest
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -0,0 +1,42 @@
+version: 2
+
+builds:
+  - binary: flagsmith
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -trimpath
+    ldflags:
+      - >-
+        -s -w -X github.com/Flagsmith/flagsmith-cli/internal/version.Version={{ if .IsSnapshot }}v{{ .Version }}{{ else }}{{ .Tag }}{{ end }}
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    goos:
+      - linux
+      - darwin
+      - windows
+    goarch:
+      - amd64
+      - arm64
+
+archives:
+  - name_template: "flagsmith_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    formats:
+      - tar.gz
+    format_overrides:
+      - goos: windows
+        formats:
+          - zip
+    files:
+      - LICENSE
+      - README.md
+
+checksum:
+  name_template: checksums.txt
+
+# changelog handled by release-please.
+changelog:
+  disable: true
+
+release:
+  mode: keep-existing
+  prerelease: auto